Technical intelligence and weaponization dossier for CVE-2017-11882. Documented exploitation across 35 active malware families totaling 43,978 analyzed telemetry samples.
| Vulnerability ID | CVE-2017-11882 |
|---|---|
| Common Name / Bulletin | Microsoft Office Equation Editor Stack Buffer Overflow (EQNEDT32.EXE) (Microsoft Patch Tuesday) |
| CWE Classification | CWE-119: Stack Buffer Overflow in EQNEDT32.EXE |
| Affected Software & Versions | Microsoft Office 2007, 2010, 2013, 2016 |
| Technical Root Cause | Stack buffer overflow in EQNEDT32.EXE font name copying routine due to lack of bounds check on a 32-byte buffer. Compiled in 2000 without ASLR or DEP protections. |
| Associated ATT&CK Techniques |
Empirical catalog telemetry verifies that the following 35 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:
| Malware Family | Category | Catalog Samples | Operational Profile |
|---|---|---|---|
| emotet | Loader | 12,943 | Emotet (initially identified in 2014 as Geodo or Heodo) is historically recognized as one of the most destructive and costly botnet malware loaders ever observe... |
| fareit | Infostealer | 10,955 | Fareit (widely recognized across the threat intelligence community as Pony or Pony Stealer) is one of the most influential and pervasive credential-harvesting i... |
| ursnif | Banking Trojan | 8,188 | Ursnif (also widely known by its underlying codebase names Gozi and ISFB) is one of the most enduring and technically sophisticated banking trojans and modular ... |
| razy | Infostealer | 3,391 | Razy (cataloged across cybersecurity research as Trojan:Win32/Razy, Trojan.Win32.Razy, and Trojan.Razy.gen) is a sophisticated Windows trojan and information st... |
| nanocore | Rat | 2,400 | NanoCore is an extensively proliferated, modular .NET-based Remote Access Trojan (RAT) originally created in 2013 by software developer Zachary Shames of Great ... |
| azorult | Infostealer | 1,513 | AZORult is an infamous, highly efficient commodity information stealer and malware downloader first commercialized in 2016 by Russian underground developer 'Pav... |
| khalesi | Infostealer | 555 | Backdoor:Win32/Khalesi is an evasive, modular information stealer and Remote Access Trojan (RAT) engineered to harvest corporate banking credentials, system con... |
| vbkryjetor | Packer | 551 | Vbkryjetor (identified across commercial security telemetry as Packer:Win32/Vbkryjetor, Trojan:Win32/Vbkryjetor, and Crypter.Vbkryjetor) is a specialized Visual... |
| skeeyah | Trojan | 440 | Trojan:Win32/Skeeyah is a widely encountered family of evasive trojan loaders and multi-stage droppers documented extensively in Microsoft Windows Defender tele... |
| farfli | Rat | 360 | Trojan:Win32/Farfli is a sophisticated Remote Access Trojan (RAT) derived from the leaked Gh0st RAT codebase, customized extensively by Chinese state-sponsored ... |
| genkryptik | Packer | 353 | GenKryptik (classified across cybersecurity vendors as Trojan:Win32/GenKryptik, Packer:Win32/Kryptik, and Trojan.GenKryptik) is an evasive multi-stage software ... |
| kasidet | Pos Malware | 294 | Kasidet (cataloged across threat research as Neutrino Bot, Win32/Kasidet, Trojan.Kasidet, and Backdoor:Win32/Kasidet) is a sophisticated modular Windows botnet ... |
| banload | Downloader | 288 | Banload (cataloged across security software as TrojanDownloader:Win32/Banload, Trojan-Downloader.Win32.Banload, and Win32/Banload) is a notorious family of troj... |
| njrat | Rat | 280 | njRAT (also tracked as Bladabindi, Njw0rm, and Backdoor:MSIL/Bladabindi) is a notorious, widely disseminated remote access trojan (RAT) developed in Microsoft V... |
| daws | Ransomware | 246 | TrojanDownloader:Win32/Daws (cataloged across security vendors as Trojan.Daws or Ransom.Daws) is a persistent Windows trojan downloader and stage-one ransomware... |
| remcos | Rat | 198 | Remcos (an acronym for 'Remote Control & Surveillance') is a feature-rich, commercial Remote Access Trojan first released in 2016 by Italian software developer ... |
| quasar | Rat | 148 | Quasar (broadly tracked as Quasar RAT, QuasarRAT, Backdoor:MSIL/Quasar, and Trojan.MSIL.Quasar) is a high-performance open-source remote access trojan (RAT) dev... |
| bsymem | Ransomware | 144 | Trojan:Win32/Bsymem (cataloged across vendor telemetry as Trojan.Bsymem or Ransom.Bsymem) is a stealthy dual-stage remote access backdoor and enterprise ransomw... |
| spygate | Rat | 127 | Backdoor:Win32/Spygate (widely known as SpyGate-RAT) is a prominent, commercial Remote Access Trojan builder developed in .NET and Visual Basic that emerged in ... |
| gozi | Banking Trojan | 113 | Trojan:Win32/Gozi (also universally tracked as ISFB and the Ursnif family tree) is one of the most historically significant, resilient banking trojans in comput... |
| asyncrat | Rat | 95 | AsyncRAT is an open-source remote access trojan (RAT) developed in C# (.NET) that has emerged as one of the most widely deployed commodity backdoors by cybercri... |
| netwiredrc | Rat | 72 | Trojan:Win32/Netwire (cataloged as NetWiredRC, or simply NetWire) is an infamous cross-platform Remote Access Trojan (RAT) and infostealer that was commercially... |
| dridex | Banking Trojan | 59 | Dridex (also known as Bugat v5, Cridex, and Dridex Banking Trojan) is an infamous, highly sophisticated banking trojan and modular malware framework first docum... |
| lokibot | Infostealer | 55 | LokiBot (also designated as Loki PWS) is a widely proliferated commodity information stealer and keylogger first observed in 2015. Authored by an underground de... |
| netwire | Rat | 55 | NetWire (cataloged across threat research as NetWire RAT, NetWire.RC, Backdoor:Win32/Netwire, and Trojan.Netwire) is a cross-platform remote access trojan (RAT)... |
| agenttesla | Infostealer | 43 | Agent Tesla is an accessible, highly ubiquitous commercial info-stealer and keylogger built on the Microsoft .NET framework. First surfacing in late 2014, the t... |
| formbook | Spyware | 35 | Formbook (rebranded in recent generations as XLoader) is a prolific, cross-platform information stealer and spyware implant offered on underground cybercrime fo... |
| danabot | Banking Trojan | 32 | DanaBot is a sophisticated modular banking trojan, stealer, and loader platform first identified in May 2018 by Proofpoint security researchers. Authored in Emb... |
| smokeloader | Loader | 21 | SmokeLoader (also cataloged in threat telemetry as Dofoil or Sharapov) is a veteran modular malware loader and botnet first commercialized in 2011 by an undergr... |
| pony | Infostealer | 10 | Pony (cataloged across cybersecurity authorities as Fareit, Siplog, Trojan:Win32/Fareit, and PWS:Win32/Fareit) is one of the most prolific commodity information... |
| hermes | Ransomware | 7 | Ransom:Win32/Hermes is a targeted, destructive ransomware strain first observed in early 2017 across Russian cybercrime underground forums. In October 2017, Her... |
| gh0st | Rat | 4 | Gh0st RAT (also tracked as Ghost RAT, Backdoor.Gh0st, and Win32/Gh0st) is one of the most historically significant, modular, and widely weaponized Remote Access... |
| necurs | Spam Bot | 2 | Botnet:Win32/Necurs was one of the largest, most pervasive botnet infrastructures in cybercrime history, comprising over 9 million compromised computers across ... |
| vidar | Infostealer | 1 | Trojan:Win32/Vidar (commercially marketed as Vidar Stealer) is a prolific, commercially available information-stealing trojan first observed on underground Russ... |
| bandook | Rat | Sampled | Bandook (derived from the Arabic and Hindi word for 'gun' or 'rifle') is an enduring, modular Remote Access Trojan first created in 2005 by Lebanese software au... |
Threat intelligence confirms the following adversaries weaponize CVE-2017-11882 in enterprise intrusions and campaign toolkits:
Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2017-11882 in enterprise networks:
Sysmon Event ID 1: eqnedt32.exe spawning child processes (powershell.exe, cmd.exe, mshta.exe, certutil.exe, regsvr32.exe).SOC containment checklist and attack surface reduction measures to neutralize exploitation:
For end-to-end incident response procedures, consult our dedicated playbook: Ransomware Containment & Incident Response →